Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Ship darnit itself in a hermetic container to eliminate host-environment as an audit-nondeterminism source

Open
  • Is something wrong?
#423 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
docker, github-actions, python
Domain
devops, infrastructure, release

Research direction

Start by reading feature 012 and its existing release assets to find where packaging, GHCR publishing, signing, and SBOM generation belong. Then inspect the workspace Python target, lockfile, release runbook, and CI setup; the issue names packaging/Dockerfile as a possible location. Done means a pinned non-root image is published with the existing release surfaces, documented usage, and a CI smoke test that runs a mock audit against a fixture repo.

Written by the indexing model from the issue text.

Description

infrastructure

Summary

Short-term shippable companion to the determinism set (#418-#421):
publish darnit itself as a pinned container image so audit output is
not influenced by the operator's host environment (Python version,
gh CLI version, git version, tree-sitter version, LLM SDK version,
etc.).

This does not help the audited repo's reproducibility. It closes a
different loop: darnit's own audit runs are more reproducible across
operators when everyone runs the same pinned binaries.

Scope

  • Add a Dockerfile at packaging/Dockerfile (or wherever feature 012
    already lands packaging assets):
    • Pin Python interpreter version (matching workspace target).
    • uv sync --frozen for lockfile-pinned deps.
    • Install pinned versions of gh CLI, git, syft, cosign as
      needed by darnit's exec handlers.
    • Non-root user; minimal working-dir layout.
    • ENTRYPOINT ["darnit"].
  • Publish under the same release surfaces feature 012 already uses
    (GHCR image, cosign-signed, SBOM via syft).
  • Document usage in the release runbook (mount repo as
    /workspace, pass GH_TOKEN, ANTHROPIC_API_KEY env vars).
  • Add a smoke-test in CI that pulls the image and runs a mock audit
    against a fixture repo to catch regressions.

Non-goals for v0

  • Automatic invocation from darnit audit (the container is a
    distribution shape, not a runtime dependency of the CLI).
  • Devcontainer image for darnit development (separate concern;
    the shipped image is for audit execution).
  • Rootless / distroless base variants (nice-to-have; revisit if
    operators ask).
  • Reproducible-build guarantees on the image itself (bit-for-bit
    container reproducibility is #227 / feature 012's territory).

Constitution alignment

  • II. Conservative-by-Default: eliminating host-env drift from
    audit output preserves the "same commit -> same verdict" invariant
    that the determinism issues (#418 in particular) are chasing at
    the code-path level.

Related

  • 012-packaging-distribution -- reuses the existing release
    infrastructure (SBOM, cosign, GHCR).
  • #227 (HermeticBuild -- evolve beyond grep-based heuristic) --
    the image itself is a small proof point that darnit knows how to
    ship a hermetic build.
  • #418 (Determinism Tier 1) -- companion; a hermetic runner
    closes the host-side lever the code-side determinism fixes leave
    open.
  • Design conversation 2026-09-05 -- filed as short-term
    companion to the environment-generation sieve issue (filed
    alongside this one) while that ambitious sieve is still in
    investigation.
Dominant language
Python
Stars
22
Forks
27
Avg merge
2d 1h
Merged PRs (30d)
35

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from darnitdevorg/darnit

All issues in darnitdevorg/darnit

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.